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REMARKS 

The Applicants and the undersigned thank Examiner Cangialosi for his time and 
consideration given during the telephonic interview with the undersigned on August 2, 2005. 
Hie AppUcants also thank Examiner Cangialosi for his carefiil review of this application. Claims 
1-59 have been rgected by the Examiner. Upon entry of this amendment. Claims 1-59 remain 
pending in this appUcation. The seven independwit claims are Claims 1,12, 23, 30, 39, 48, and 
57. 

Consideration of the present application is respectfiilly requested in light of the above 
amendments to the a]>plication and in view of the following remarks. 

Sirnifnary of Telephonic Tnterview qf Au^ 2. 200S 

The Applicants and the undersigned thank Examiner Cangialosi for his time and 
consideration given during the telephonic intsaview of August 2, 2005. During this telephonic 
interview, a proposed amendment to the claims was discussed. The Applicants provided the 
proposed amendment to the claims in advance of the interview. 

During the telephonic interview, it was explained to ^caminer Cangialosi that the prior 
ait of record does not provide any teaching of providing temporaiy authraization data for use 
with an authentication table that is associated with an information account. It was also explained 
that the prior art does not provide any authentication table to determine at least one of: viiether a 
temporaiy authorization is being used by an authorized party viho is not the consumer, whether a 
temporary authorization has expttcd, and v»*at level of access to the information account is 
associated with a temporary authorization. See, for example, amended independent Claims 1, 12, 
30, 39, 48, and 57. 

For independMit Claim 23, it \ras explained that flie prior art also does not provide any 
teaching of embedding the temporaiy authorization as a parameter in a uniform resource locator 
with an authentication module and redirecting the browser of the client device with a first server 
to a web page hosted by a second server and associated with a third-par^ using the uniform 
resource locator. The prior art also does not teach subsequentiy receiving a communication with 
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the first server from the second server hosting the web page comprising the further request for 
access to the information account along with the temporary authorization. And the prior art does 
not teach that in response to receiving the temporary authorization with the first server, 
authenticating the third-party with the authentication module to access the information account 
according to the access privileges associated with the temporary authorizatioa 

Examiner Cangialosi was asked by the undersigned if the proposed amendment to the 
claims overcame the rejection made by the Examiner wider 35 U.S.C. §1 12, second paragraph. 
Examiner Cangiolosi told the undersigned that the claims should flmher describe the computer 
operating aivkonment or computer context in order to overcome the rejection under 35 U.S.C. 
§112, second paragraph. The Applicants note that &e claims as presented by this amendment 
include more context and the exemplary computer operating environm«it, as suggested by 
Examiner Cangialosi. 

The Applicants and the undersigned request the Examiner to review this interview 
summary and to approve it by writing "Interview Record OK" along with his initials and the date 
next to this summary in the margin as discussed in MPEP § 713.04, p. 700-202. Consideration 
and approval of this interview summary record are respectfully requested. 

Rfiiection under 35 U.S C 6 1 12. secon d naragranh 

The Examiner rejected Claims 1-59 under 35 U.S.C. § 112, second paragraph, as being 
indefinite for failing to particularly pomt out and distinctly claim the subject matter vduch the 
Applicant regards as the invention. In response to this rejection, ttie Applicant have amended 
these claims in accordance with the Examiner's very helpfid conunents made in the Office 
Action and during the telephonic interview as discussed above. Reconsideration and withdrawal 
of these rejections are lespectflilly requested. 
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Rejections und e r 35 U.S.C, S 103 

The Examiner has rejected Claims I-S9 under 35 U.S.C. § 103 as being unpatentable over 
the U.S. Patent No. 6,321^39 issued in the name of French et al. (hereinafter, the "French 
reference") in view of U.S. Patent No. 5,889,942 issued in ihe name of Orenshteyn (hereinafter, 

the **Orenshtcynreference")» 

The Applicant respectfiilly offers remarks to liaverse these rejections- The Applicant AViU 
addiess each independent claim separately as the Applicant believes that each independent claim 
is separately patentable over the prior art of record. 



Independent Claim. ! 

The rejection of Claim 1 is respectfully traversed. It is respectfully submitted that the 
French and Orenshteyn references fail to describe, teach, or suggest the combination of: (1) 
storing an infomiation account in a central data repositoiy that is accessible via a distributed 
computer network, (2) the infonnation account containing consumer information elements that 
aie changed by the consumer, (3) associating consumer authentication information with the 
information account using a server such that access to the information account by the consumer 
is conditioned upon receipt and verification of the consumer authentication information by the 
server, (4) flirther associating a temporary authorization witti the information account using an 
authentication module running on the server, (5) tiie temporary authorization having consumer- 
defined attributes that define access privileges that will be granted to a person vrfio presents the 
temporary authorization along with a request for access to Hit infonnation account; (6) receiving 
the temporary authorization firom the distributed computer network; (7) comparing the temporary 
authorization to data in an authentication table associated with the information account using the 
authentication module in order to determine at least one of: (7a) whether the temporary 
authorization is being used by an authorized party vjbo is not the consumer, (7b) whether the 
temporary authorization has expired, and (7c) vrtiat level of access to the information account is 
associated with the temporary authorisation; and (8) granting a level of access to the information 
account by the authentication module based on the temporary authorization if the temporary 
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auiiiorization is found vaUd based on the comparing step, as recited in amended independent 
Claim 1. 

The French Reference 

The French reference describes a method for aulhenticating a user who wishes to apply 
for an on-line transaction. Such transactions can include for example, an electronic brokerage 
trade that is either earned out or not carried out depending on the results of the authentication 
process. The extent of authentication processing performed can depend upon the nature of the 
transaction and vendor-specific requirements. Once 4e authentication process has been satisfied, 
the technology described by the French reference may generate a digital certificate that contains 
auflientication levels and other information related to a user, See the French reference. Col. 2, 
lines 30-48. 

The French reference explains that its technology has different levels of auth^tication to 
be performed based on the level of security desired for a particular on-line transaction. Lower 
risk transactions such as relatively small purchases may not require an extensive authentication 
process. Meanwhile, more sensitive or greater risk transactions such as large purchases may 
require a more thorough authentication process and a greater level of certainty. See the French 
reference, Col. 2, lines 5 1 -65 . 

The French reference explains that a user is authenticated according to their ability to 
respond to successive queries for personal information and the level of match attained from 
comparing the information they provide with reliable data sources. The user is initially requested 
to provide a first type of identification infonnation. The first type of information is preferably 
wallet-type information that includes infomation such as, name, address, driver's license or 
other information that may be commonly carried on the person. See steps 32 and 34 of Figure 1 
illustrated below in which a user is prompted to enter a first level of authentication. 
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The French reference doe$ not provide any teaching of comparing a temporary 
authorization to data in an authentication table associated with the information account using an 
authentication module in order to determine at least one of: whether the temporary authorization 
is being used by an authorized party who is not the consumer, whether the temporary 
authorization has expired, and wliat level of access to the information accoimt is associated with 
the temporary authorization; and granting a level of access to the information account by the 
authentication module based on the temporary authorization if the temporary authorization is 
found valid based on the comparing step^ as recited in amended independent Claim 1 . 
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Jh^ ^shtftvn Reference 

The Examiner admits that the French reference does not provide any teaching of a 
temporaiy authorization as claimed by the AppUcants. However, the Examiner relies upon the 
Otenshteyn reference to loovide a teaching of temporaiy authorization. 

The Orenshteyn icfcrence explains lhat upon initiation by a client computer 5, a selected 
server 7 as illustrated in Figure 1 starts a selected application running on ihe server 7 and the 
server 7 selectively accesses the file system and the corresponding data of a requesting cUent 5, 
The client 5 acts a peripheral device for the selected service application running remotely on the 
server 7. In turn, the remote server 7 processes the corre^nding data &om the client 5 through 
the started service plication without pennanently storing the data within tiie server 7. 

la othw words, the client 5 provides the application program nmnmg on the server 7 with 
flie file systems, screen, kcyboatds, mouse, and other attached devices to the client 5, while the 
server 7 provides running the application the logic and compute-power to the clients. See Figure 
1 illustrated below and Col. 4, lines .5 1-64 of the Orenshteyn reference. 
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The Orenshteyn reference explains that its technology allows selected restricted access 
from the application ninning on the remote server 7 to the client's permanent storage facilities 
such as the hard drives, CD-Rom drives, tape drives, floppy drives, and any other VO or other 
d^ice which may be attached to the client S. 

In other words, Ae remote server 7 performs operations on the client's local data and 
devices. Thus, the server 7 can process the data from the client 5; however, the data never 
resides permanently on the server 7. Local data is simply read from or written to the client files 
system as required by the application logic running on the server 7. See the Orenshteyn reference 
Col, 5, lines 41-54. 

The Examiner relies upon step 100 of Figure 3B illustrated below to provide a teaching of 
temporary authorization. The Orenshteyn reference explains that if the server 7 does not have 
authorization to access the files in the resource configuration file residing on a client 5, then the 
process proceeds to step 100 where the client user 5 chooses whether or not to grant a single use 
authorization for the server 7 to access the resource configuration file residing on the client's 
computer 5. 
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See Figure 3B, Step 100 of the Orenshteyn lefciencc illustrated above. If the client user 
does grant authorization, then in step 105, the server application running on the server 7 is 
pcmiitted to i«ad, write, append, rename, move, or create the corresponding file in the file system 
residing on the client computer S. 

This system described by the Orenshteyn reference is different fiom the Applicants' 
claimed invention in at least two aspects: (1) the client computer in the Orensheteyn reference 
controls the alleged "temporary authorization"; and (2) the Orenshteyn reference does not 
provide any teaching of a temporary authorization table. 

Regarding the first difference, as noted above, the client computer of the Orensheteyn 
reference controls the alleged "temporary authorization" to one or more files existing on the the 
client computer, itself. Meanwhile, the AppUcants' invention uses an authentication module 
running on a server to compare a temporary authorization to data in an authentication table to 
control access to consumer information. One of ordinary skill in the art recognizes that the client 
computer access control of the Orenshteyn reference is substantially different from a server 
running an authentication module that uses an authentication table to allow access to an 
information account stored in a central data repository. 

Regarding the second difference, like the French reference, the Orenshteyn reference does 
not provide any teaching of comparing a temporary authorization to data in an authentication 
table associated with the information account using tfie authentication module in order to 
determine at least one ofi whether the temporary authorization is being used by an authorized 
party who is not the consumer, whether the temporary authorization has expired, and what level 
of access to the information account is associated with the temporary authorization; and granting 
a level of access to the information account by flie authentication module based on the temporary 
authorization if the temporary authorization is found valid based on the comparing step, as 
recited in amended independent Claim 1. 
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Conclusion Regarding Independent Claim_l 

In Ught of the differences between amended Claim 1 and the French and Orenshteyn 
references mentioned above, one of ordinary skill in the art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvious the recitations as set forth in 
amended independent Claim 1. Accordingly, reconsideration and vdthdrawal of tWs rej^^^ 

respectfully requested. 
Tnde pendent Claim 12 

The rejection of Claim 12 is respectfully traversed. It is respectfully submitted that the 
French and Orenshteyn references fail to describe, teach, or suggest the combination of: (1) 
presentfaig to a host server via a distributed computer network a request for access by a consumer 
to an information account along with consumer authentication information, ^) the information 
account being stored in a central data repositoiy that is accessible by the host server via the 
distributed cwnputer network, (3) the information account containing consumer infonnation 
elements that are changed by the consumo; (4) receiving fiom the host server an 
acknowledgment that the consumer has been autiienticated based on the consumer authentication 
information and thereby granted access to the information account; (5) in response to tiie 
acknowledgment, transmitting to the host server a request by tiie consumer for generation of a 
temporary authorization having consumer-defined attributes that define access privileges that are 
granted to a person who presents the temporary authorization along with a subsequent request for 
access to the infonnation account; (6) receiving flie temporary authorization fix>m the distributed 
computer network with an authentication module running on the host server, (7) comparing tiie 
temporary authorization to data in authentication table associated witii the infonnation account 
using the authentication module in order to determine at least one of. (7a) whether the temporaiy 
authorization is being used by an authorized party who is not the consumer, (7b) whether flie 
temporary authorization has expired, and (7c) what level of access to the information account is 
associated with the temporary authorization; and (8) granting a level of access to the information 
account with the authentication module based on the temporary authorization if the temporary 
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authorizatioii is found valid based on the comparing step, as recited in . amended indepeiident 
Claim 12. 

As noted in the discussion of Claim 1 above, neither the French or Orenshteyn references 
provide any teaching of a temporary authorization table. And it follows that neither reference 
provides any teaching of comparing a temporary authorization to data in an authentication table 
associated with the information account using the authentication module in order to determine at 
least one of: (a) whether the temporary authorization is being used by an authorized party who is 
not the consumer, (b) whether the temporary authorization has expired, and (c) what level of 
access to the infoimation account is associated with the temporary authorization. 

In light of the differences between amended Claim 12 and tihe French and Orenshteyn 
references mentioned above, one of ordinary skill in the art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvious the recitations as set forth in 
amended independent Claim 12. Accordingly, reconsidemtion and withdrawal of this rejection 
are respectfiilly requested. 

Independent Claim 23 

The rejection of Claim 23 is respectfully traversed. It is respectfully submitted that the 
French and Orenshteyn references fail to describe, teach, or suggest the combination of (1) 
receiving a request with a first server for access to an information account and consumer 
authentication information fiom a client device executing a browser, (2) the information account 
being stored in a central data repository and containing consumer information elements that are 
changed by the consumer. (3) authenticating the consumer with the first server to access the 
information account based on the consumer authentication information; (4) in response to 
authenticating the consumer by the first server to access the information account based on the 
consimier authentication information, generating a temporary authorization with an 
authentication module running on the first server having consumer-defined attributes that define 
access privileges that are granted to an entity that presents tiie temporary authorization along with 
a further request for access to the information account; (6) embedding the temporary 
authorization as a parameter in a uniform resource locator with the authentication module and 
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redirecting the browser of the client device with the &st server to a web page hosted by a second 
server and associated with a third-party using the uniform resource locator, (7) subsequently 
receiving a communication with the first server from the second server hosting the web page 
comprising the further request for access to the information account along with the temporary 
authorization; and (8) in response to receiving the temporary authorization with the first server, 
authenticating the third-party with the authentication module to access the information account 
according to the access privileges associated with the temporary authorization, as recited in 
amended independent Claim 23. 

Neither the French nor the Otenshteyn references provide any teaching of embedding a 
temporary authorization as a parameter in a uniform resource locator with an authentication 
module and redirecting the browser of the client device with the first server to a web page hosted 
by a second server and associated with a third-party usmg the uniform resource locator. 

In light of the differences between amended Claim 23 and the French and Orensbteyn 
references mentioned above, one of ordinary skill in the art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvious the recitations as set forth in 
amended independent Claim 23. Accordingly, reconsideration and withdrawal of this rejection 
are respectfully requested. 

Independent Claim 30 

The rejection of Claim 30 is respectfhily traversed It is respectfidly submitted that the 
French and Orenshteyn references foil to describe, teach, or suggest the combination of (1) a 
central data repository accessible via a distributed computer network for storing an information 
account containing consumer information elements that are changed accessed, retrieved and 
altered by the consumer; (2) a communication device for receiving from the consumer via the 
distributed computer network consumer authentication infoimation, (3) a request for a temporary 
authorization and consumer-defined attributes defining access privileges that are granted to a 
person who presents the temporary authorization along with a request for further access to the 
information account; and (4) a processor configured for executing computer-executable 
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instructions for: (5) in response to receiving the consumer authentication information, accessing 
an authentication table to determine whether the consumer authentication information is 
associated with the information account, such that the consumer may be provided with access to 
the information account, (6) in response to determining that the consumer authentication 
information is aasociated with the information account and in response to the request for the 
tempoiaiy authorization, generating Ae temporary authorization having the consumer-defined 
attributes; (7) receiving the temporary authorization from the distributed computer network; (8) 
comparing the temporary authorization to data in the authentication table associated with the 
information account in order to determine at least one of: (8a) whether the temporary 
authorization is being used by at least one of an authori«ed person and authorized third-party who 
is not the consumer, (8b) whether the temporary authorization has expired, and (8c) what level of 
access to the information account is associated with the temporary authorization; and (9) granting 
a level of access to the information account based on the temporary authorization if the 
temporary aulfaorization is found valid based on the comparing step, as recited in amended 
independent Claim 30. 

As noted in the discussion of Claim 1 above, neiflier the French or Orenshteyn tefiercnces 
provide any teaching of a temporary authorization table. And it follows that neither reference 
provides any teaching of comparing a temporary aufliorization to data in an authentication table 
associated with Ae informadon account using the authentication module in order to determine at 
least (me of: (a) whether the temporary authorization is being used by an aufliorized party viho is 
not the consumer, (b) whether the temporary authorization has expired, and (c) what level of 
access to the information accoxmt is associated with the temporary authorization. 

In light of the differences betwem amended Claim 30 and tire French and Orenshteyn 
references mentioned above, one of ordinary skill in the art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvious the recitations as set forth in 
amended independent Claim 30, Accordingly, reconsideration and withdrawal of this rejection 
are respectfully requested. 
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Tpdependent Claim 39 

Therejectionof Claim 39 is respectfiiUy traversed It is respectfully submitted that the 
French and Orenshteyn references foil to describe, teach, or suggest the combination of: (1) 
storing the infonnation accouirt on a central data repository; (2) receiving with a server, over a 
distributed computer network, requests from different network devices for access to the 
information account, (3) each of said requests comprising an authorization identifier; (4) in 
response to each of the requests, comparing each authorization identifier to data in an 
authentication table associated with the information account using an authentication module 
naming on the server in order to determine at least one of: (4a) whether the authorization 
identifier is being used by an authorized party who is not the consumer, (4b) whether the 
authorization identifier has expired, and (4c) what level of access to the information account is 
associated with the authorization identifier, (5) if the comparing step is successful for a particular 
authorization identifier, thai retrieving a set of authorization parameters associated with the 
particular authorization identifier using the authentication module, (6) said authori2ation 
parameters being defined by the entity wiiose information is stored in the information account; 
and (7) granting access to eadi of the network devices with the authentication module if the 
comparing step is successful and (8) in accordance vAih the authorization parameters retrieved in 
response to the network device's request, as recited in amended independent Claim 39. 

As noted in the discussion of Claim 1 above, neither the French or Orenshteyn references 
provide any teaching of a temporary authorization table. And it fbllows diat neither reference 
provides any teaching of comparing a temporary aufliorization to data in an authentication table 
associated with die information account using the authentication module in order to determine at 
least one of: (a) whether the t^nporary authorization is being used by an authorized party who is 
not the consumer, (b) whettier the temporary autfiorization has expired, and (o) vAat level of 
access to the infoimation account is associated with the temporary authorization. 

In light of the differences between amended Claim 39 and the French and Orenshteyn 
references mentioned above, one of ordinary skill in the art recognizes that the combination 
proposed by the Examiner caimot anticipate or render obvious the recitations as set forth in 
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amended independent Claim 39. Accoidinglyi reconsideration and withdrawal of this rejection 
are respectfully requested. 

fadependent Claim 48 

The rejection of Claim 48 is respectfully traversed. It is respectfully submitted that the 
French and Orenshteyn references faU to describe, teach, or suggest the combination of: (I) a 
data repository storing an information account; (2) a computer network interface for receiving, 
over a distributed computer network. (3) requests fifom different network devices for access to 
the information account, (4) each of said requests comprising an authorization identifier; and (5) 
a processor for comparing each authorization identifier to data in an authentication table 
associated with the infiwmation account in order to detennine at least one of: (5a) whefter the 
authorization identifier is being used by an authorized party who is not the entity whose 
information is stored in the information account, (5b) whether the authorization identifier has 
e:q)ired, and (5c) what level of access to the information account is associated with the 
authorization idraitificr, (6) said processor configured to retrieve a set of authorization parameters 
associated with the authorization identifier if a comparison between a respective authorization 
identifier and data in the authentication table is successfiil, (7) said processor granting access to 
each of the network devices in accordance wifli the authorization parameters retrieved in 
response to the network device's request and if a comparison between a respective authorization 
identifier and data in the authentication table is successfiil; (8) wherein said authorization 
parameters are defined by the enti^ whose information is stored in the information account, as 
recited in amended independent Claim 48. 

As noted in the discussion of Claim 1 above, neither the French or Orenshteyn references 
provide any teaching of a temporary authorization table. And it follows that neither reference 
provides any teaching of comparing a temporary authorization to data in an authentication table 
associated with the information account using the authentication module in order to deteimine at 
least one of: (a) whether the temporary authorization is being used by an authorized party viho is 
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not the consumer, (b) whether the temporary authorization has expired, and (c) what level of 
access to the information account is associated with the temporary authorization. 

In light of the differences between amended Claim 48 aod the French and Orenshteyn 
references mentioned above, one of ordinary skill in the art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvious the recitations as set forth in 
amended independent Claim 48. Accordingly, reconsideration and withdrawal of this rejection 
axe respectfiilly requested. 

Independent f^iaiwi «i7 

The rejection of Claim 57 is lespectfiilly traversed. It is respectfully submitted that the 
French and Orenshteyn references fiil to describe, teach, or suggest the combination of: (1) 
storing data for a consumer information account (2) laovidmg an interfece whereby an owner of 
the consumer hiformation account can specify tiie terms by which third parties can access tiie 
consumer infonnation account; (3) storing flic terms for ftiture use in an authentication module of 
a server; (4) associating the stored terms with one or more authorization tickets; (5) tiransmitting 
tiie authorization tickets to specified fliird parties; (6) receivtog tiie authorization tickets from a 
distributed computer netw<nk; (7) comparing the authorization tickets to data in the 
authenticatitm table associated witii the consumer information account using the autiientication 
module in order to detennine at least one of: (7a) whether the authorization ticket is being used 
by an airfhorized tiiird-party who is not the consumer, (7b) whether the temporary authorization 
has expired, and (7c) what level of access to the information account is associated with the 
temporary authorization; and (8) granting a level of access to the consumer information account 
based on the authorization ticket if the authorization ticket is found valid based on the comparing 
step, as recited in amended independent Claim 57. 

As noted in the discussion of Claim 1 above, neither the French or Orenshteyn references 
provide any teaching of a temporary authorization table. And it follows that neither reference 
provides any teaching of comparing a temporary authorization to data in an authentication table 
associated with tiie information account using the authentication module in order to determine at 
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least one of: (a) whether the temporary authorization is being used by an authorized party who is 
not the consumer, (b) whether the temporary authorization has expired, and (c) what level of 
access to the infoimation account is associated with the temporary authorization.. 

In Ught of the differences between amended Claim 57 and the French and Orenshteyn 
lefeiences mentioned above, one of ordinary skUl in the art recognizes that the combination 
proposed by tiie Examiner cannot anticipate or render obvious the recitations as set forth in 
amended independent Claim 57. Accordingly, reconsideration and withdrawal of this rejection 
are respectfully requested. 

Dependent Claim ^t %1 1 13-22. 31-38. 40^7. 49-56. 58^59 

The Applicants respectftdly submit that die above-identified dependent claims are 
allowable because the independent claims from which they depend are patentable over die cited 
references. The Applicants also respectfully submit that the recitations of these dependent claims 
are of patostable significance. 

In view of the foregoing, the Applicants respectfully request that the Examiner withdraw 
the pending rejections of dependent Claims 2-11. 13^22, 24-29, 31-38, 40-47, 49-56, 58-59. 

CONCLUSION 

The foregomg is submitted as a full and complete response to the Office Action muled 
on March 2, 2005. The Applicants and the undersigned thank Examine Cangialosi for 
consideration of these remarks. The Applicants have amended the claims and have submitted 
remarics to traverse rejections of Claims 1-59. The Applicants respectfiilly submit that the 
present application is in condition for allowance. Such action is hereby courteously solicited. 



■35- 
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If the Examiner believes that there are any issues that can be resolveid. by a telephone 
conference, or that there are any fonnalities that can be corrected by an Examiner's amendment, 
please contact the undersigned in the Atlanta Metropolitan area (404) 572-2884. 



KINO & SPALDING, IXP 

45* Floor, 191 Peachtiee Street, N.E. 

Atlanta, Georgia 30303 

404.572.4600 

K&S Docket: 072S8-1OSO0S 
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Respectfully submitted. 



SteVt 
Reg. 
Septt 
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